CWE-289

49 published CVEs are weaknesses of this kind, as the records or NVD name it.

Critical 10High 25Medium 13Low 1Not scored 0

CVEs per yearBy the year they were published

CVE-2026-100351
kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion
getkin · kin-openapi
High7.4
CVE-2026-104143
DataEase: Stored SQL Injection via dateFormat field templates
dataease · dataease
High8.7
CVE-2026-57176
social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backend
python-social-auth · social-core
Medium6.8
CVE-2026-95514
WordPress Netgsm plugin <= 2.10.0 - Bypass Vulnerability vulnerability
netgsm · Netgsm
Medium5.3
CVE-2026-76183
Apache Tomcat: Bypass of security constraints for WebSocket endpoints
Apache Software Foundation · Apache Tomcat
Critical9.8
CVE-2026-73511
Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat)
envoyproxy · envoy
Medium5.3
CVE-2026-92579
AVideo through 29.0 Broken Access Control via CSRF Exemption Basename Collision
WWBN · AVideo
Medium5.3
CVE-2026-12101
Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access
IBM · Verify Identity Access
High8.1
CVE-2026-15980
MyHome Core <= 4.4.5 - Authentication Bypass to Account Takeover via Activation Token
TangibleWP · MyHome Core
Critical9.8
CVE-2026-32639
Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads
wintercms · winter
Medium6.8